I knew I forgot to put this in my previous message. I've distilled my syslog-ng.conf file to: # syslog-ng configuration file. options { sync (0); time_reopen (10); log_fifo_size (1000); create_dirs (yes); chain_hostnames (yes); use_dns (no); use_fqdn (yes); }; source s_sys { sun-streams ("/dev/log" door("/etc/.syslog_door")); internal(); tcp(); udp(); }; destination d_file_messages { file("/var/adm/messages" perm(0644)); }; filter f_lvl_err { level(err); }; log { source(s_sys); filter(f_lvl_err); destination(d_file_messages); } When I start syslog-ng, I get this: # /usr/local/sbin/syslog-ng -v -f /tmp/my.conf binding fd 7, inetaddr: 0.0.0.0, port: 514 binding fd 8, inetaddr: 0.0.0.0, port: 514 Yan.